fix: vendor dashboard fonts + vault_exec docs cleanup

- Geist/Geist Mono via @fontsource inside the Vite bundle — the
  Google Fonts <link> was blocked by the nginx CSP (style-src 'self'),
  so the dashboard silently fell back and phoned home on self-hosted
  instances. Fonts now serve from /assets under 'self' — CSP-clean,
  airgapped, no console violation.
- mcp README: vault_exec described the old deny-list; rewritten for
  the allow-list contract.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

apps/frontend/index.html

@@ -16,13 +16,6 @@
     <meta name="apple-mobile-web-app-status-bar-style" content="black-translucent" />
     <meta name="apple-mobile-web-app-title" content="Primora" />
 
-    <link rel="preconnect" href="https://fonts.googleapis.com" />
-    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
-    <link
-      href="https://fonts.googleapis.com/css2?family=Geist:wght@400;500;600;700&family=Geist+Mono:wght@400;500&display=swap"
-      rel="stylesheet"
-    />
-
     <style>
       html { background: #0a0a0b; color-scheme: dark; }
       html.light { background: #fafaf9; color-scheme: light; }

apps/frontend/package.json

@@ -10,6 +10,8 @@
     "test": "vitest run"
   },
   "dependencies": {
+    "@fontsource/geist": "^5.3.0",
+    "@fontsource/geist-mono": "^5.3.0",
     "@primora/api-client": "0.5.0",
     "@primora/shared-types": "0.5.0",
     "better-auth": "^1.5.6",

apps/frontend/src/index.css

@@ -5,6 +5,15 @@
    hairlines, tabular numerals, no decoration.
    ============================================================ */
 
+/* Vendored via @fontsource — self-hosted, no runtime Google dependency
+   (the nginx CSP only allows 'self'). */
+@import "@fontsource/geist/400.css";
+@import "@fontsource/geist/500.css";
+@import "@fontsource/geist/600.css";
+@import "@fontsource/geist/700.css";
+@import "@fontsource/geist-mono/400.css";
+@import "@fontsource/geist-mono/500.css";
+
 @tailwind base;
 @tailwind components;
 @tailwind utilities;